Containerized execution of secure model context protocol servers for artificial intelligence agents

Abstract

The system securely executes model context protocol (“MCP”) processes for artificial intelligence (“AI”) agents by creating nano sandboxes in which the MCP processes execute. A server-sent events (“SSE”) bridge identifies a request to initialize an SSE channel with an MCP server. The SSE bridge instantiates a nano sandbox based on a definition extracted from the request, creating a custom and dynamic isolated execution environment. An MCP process is launched within the nano sandbox. The SSE bridge returns a session identifier, receives a command and the session identifier, and forwards the command to the nano sandbox based on the session identifier. The MCP process executes the command within the nano sandbox, and responds over the SSE channel to the MCP client. When the SSE connection closes the nano sandbox can then be destroyed.

What is claimed is: 
     
         1 . A method for securely executing model context protocol (“MCP”) processes with artificial intelligence (“AI”) agents, comprising:
 identifying, at a server-sent event (“SSE”) bridge, a request to initialize an SSE channel with an MCP server, the request being sent from an MCP client that generates MCP-compliant resource commands in association with an AI agent; 
 instantiating a nano sandbox based on a definition extracted from the request, wherein the nano sandbox is an isolated execution environment; 
 initiating execution of the MCP server within the nano sandbox; 
 transmitting, to the MCP client, a session identifier; 
 receiving, from the MCP client, a resource command and the session identifier; 
 transmitting the resource command to the nano sandbox based on the session identifier; 
 causing the MCP server to execute the resource command; 
 receiving a resource output of the MCP server in the nano sandbox; and 
 transmitting a response over the SSE channel to the MCP client, wherein the response is the resource output or a modified version of the resource output. 
 
     
     
         2 . The method of  claim 1 , wherein the definition is included in a hypertext transfer protocol (“HTTP”) header of the request. 
     
     
         3 . The method of  claim 1 , further comprising:
 receiving, at the SSE bridge, a hypertext transfer protocol (“HTTP”) post from the MCP client or a second MCP client, and wherein the HTTP post comprises a second resource command; and   instantiating a second nano sandbox that is ephemeral for the second resource command, wherein the second nano sandbox is created, used, and terminated in response to the second resource command.   
     
     
         4 . The method of  claim 3 , wherein no SSE channel is established for the second resource command. 
     
     
         5 . The method of  claim 1 , wherein the resource command is a remote procedure call (“RPC”) encoded in JSON. 
     
     
         6 . The method of  claim 1 , wherein the SSE bridge forwards the resource command to the nano sandbox, receives the output from the nano sandbox, and sends the response to the client. 
     
     
         7 . The method of  claim 1 , wherein the SSE bridge terminates the MCP server in an instance in which the SSE channel closes. 
     
     
         8 . The method of  claim 7 , wherein the SSE bridge disposes of resources used by the nano sandbox and removes the nano sandbox from memory. 
     
     
         9 . The method of  claim 1 , wherein the SSE bridge pings the nano sandbox, wherein the nano sandbox returns the ping when the MCP server is initialized, and wherein the SSE bridge waits for the returned ping before sending the returning the session identifier to the client. 
     
     
         10 . The method of  claim 9 , wherein the SSE bridge comprises a timeout threshold for receiving the returned ping, wherein the SSE bridge sends a kill signal to the MCP server in an instance in which the timeout threshold is exceeded. 
     
     
         11 . The method of  claim 1 , wherein the MCP server uses STDIO-based communication, and wherein the SSE bridge writes the resource command to an STDIN pipe of the MCP server. 
     
     
         12 . The method of  claim 11 , wherein the SSE bridge receives the output on an STDOUT pipe of the MCP server. 
     
     
         13 . The method of  claim 1 , wherein the SSE bridge creates the nano sandbox using a bubblewrap command that restricts file system access to one or more specified directories. 
     
     
         14 . The method of  claim 13 , wherein the bubblewrap command further defines network access and establishes system call filtering for the nano sandbox. 
     
     
         15 . The method of  claim 1 , wherein the SSE bridge selects a first mode of operation for the nano sandbox, wherein the first mode causes the SSE bridge to maintain the nano sandbox for ongoing interactions in a session with the MCP client, and wherein a second mode of operation causes the SSE bridge to terminate a container of a second nano sandbox after responding to a single request from the MCP client. 
     
     
         16 . The method of  claim 1 , wherein the definition identifies a first tool, and wherein the MCP server is selected based on the first tool. 
     
     
         17 . The method of  claim 16 , wherein the nano sandbox is created to contain resources dependencies of the first tool, and wherein the first tool is associated with different resource dependencies than a second tool. 
     
     
         18 . The method of  claim 1 , wherein the MCP server supports multiple tools. 
     
     
         19 . A non-transitory, computer-readable medium containing instructions for securely executing model context protocol (“MCP”) processes with artificial intelligence (“AI”) agents, wherein the instructions are executed by at least one processor to perform stages comprising:
 identifying, at a server-sent event (“SSE”) bridge, a request to initialize an SSE channel with an MCP server, the request being sent from an MCP client that generates MCP-compliant commands in association with an AI agent; 
 instantiating a nano sandbox based on a definition extracted from the request, wherein the nano sandbox is an isolated execution environment; 
 launching the MCP server within the nano sandbox; 
 returning, to the MCP client, a session identifier that identifies the nano sandbox; 
 receiving, from the MCP client, a command and the session identifier; 
 forwarding the command to the nano sandbox based on the session identifier; 
 causing the MCP server to execute the command within the nano sandbox; 
 receiving an output of the MCP server in the nano sandbox; and 
 sending a response over the SSE channel to the MCP client, wherein the response is the output or a modified version of the output. 
 
     
     
         20 . A system for securely executing model context protocol (“MCP”) processes with artificial intelligence (“AI”) agents, the system comprising:
 at least one physical non-transitory, computer-readable medium comprising instructions; and 
 at least one processor that executes the instructions to perform stages comprising:
 identifying, at a server-sent event (“SSE”) bridge, a request to initialize an SSE channel with an MCP server, the request being sent from an MCP client that generates MCP-compliant commands in association with an AI agent; 
 instantiating a nano sandbox based on a definition extracted from the request, wherein the nano sandbox is an isolated execution environment; 
 launching the MCP server within the nano sandbox; 
 returning, to the MCP client, a session identifier that identifies the nano sandbox; 
 receiving, from the MCP client, a command and the session identifier; 
 forwarding the command to the nano sandbox based on the session identifier; 
 causing the MCP server to execute the command within the nano sandbox; 
 receiving an output of the MCP server in the nano sandbox; and 
 sending a response over the SSE channel to the MCP client, wherein the response is the output or a modified version of the output.